CVE Intelligence
Analysis AI-assisted

CVE-2025-11424: code-projects Web-Based Inventory and POS System SQL injection in login.php

A SQL injection flaw in the login.php file of code-projects Web-Based Inventory and POS System 1.0 can be triggered remotely through the emailid argument. NVD scores it 9.8 (CVSS 3.1, critical), while VulDB provides lower CVSS 4.0 scores. No fixed version appears in the consulted records, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-11424 affects code-projects Web-Based Inventory and POS System version 1.0. According to the record, the flaw is in the /login.php file and can be reached by manipulating the emailid argument, which may lead to SQL injection. The record classifies the weakness as CWE-74 (Injection).

Impact

  • NVD assigns a base score of 9.8 (CVSS 3.1, critical) with high confidentiality, integrity and availability impact.
  • VulDB lists CVSS 4.0 scores of 6.9 and 5.5 from its own provider entries.
  • A successful injection could expose or alter data handled by the login workflow and the database behind it. This is an inference from the vulnerability class, not a tested result.

Affected products and versions

  • Code-projects Web-Based Inventory and POS System, version 1.0.
  • Fabian Web-based Inventory And Pos System, version 1.0, which is also listed in the record.

The record does not provide any fixed version.

Exploitation status

The CVE is not listed in CISA KEV, so this analysis does not state active exploitation. The record states that a public exploit has been disclosed and may be used, and the SSVC exploitation value is poc (proof of concept). No confirmed exploitation appears in the sources consulted. The EPSS entry in the record shows a probability of 0.00478 and a percentile of 0.39553.

Remediation and mitigation

  • Check the vendor and the code-projects site for an updated release, since the record lists no fix.
  • If no fix exists, restrict access to the login interface to trusted networks and remove the application from internet exposure where possible.
  • Ask developers to replace string-built database queries with parameterized queries and to validate the emailid input on the server side.
  • Use a web application firewall as a temporary compensating control, understanding that it does not replace a code fix.
  • Review whether the application is still needed and retire unused instances.

Detection guidance

  • Review web server and application logs for requests to login.php with unusual or malformed emailid values.
  • Watch for database errors returned from the login page and for unexpected spikes in login attempts.
  • Monitor for unexpected database queries or account changes after login requests.

Limitations of the available information

  • The record gives no fixed version, vendor advisory or patch.
  • The record lists CWE-74, which is a broad injection category. The specific SQL injection class is inferred from the description.
  • The record does not include a tested proof of impact, so the real effect depends on the deployment.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the source.

Frequently asked questions

Is CVE-2025-11424 being actively exploited?

The CVE is not listed in CISA KEV, so this analysis does not state active exploitation. The record says a public exploit has been disclosed, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version for this vulnerability?

The record does not list any fixed version. Check the vendor and the code-projects site for an updated release, and apply compensating controls if none is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.